MTA-STS not configured — enforcing TLS on inbound mail
SMTP encryption is opportunistic by default: if the TLS handshake fails, mail is delivered in the clear. MTA-STS (RFC 8461) lets you declare that senders must use TLS to reach you.
It needs two things: a TXT discovery record, and a policy file served over HTTPS at mta-sts.yourdomain.com. Mailward checks the discovery record only — verifying the policy file is a job for your own deployment checks.
How to fix it
- 1Host a policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt listing your MX hosts.
- 2Publish a TXT record at _mta-sts.yourdomain.com with: v=STSv1; id=20260101000000
- 3Start with mode: testing, and move to mode: enforce once the TLS-RPT reports are clean.
- 4Bump the id value every time you change the policy file.
Check whether your domain has this problem
Free, no signup, about two seconds. You get the exact record to paste.
Related guides
- DKIM record with empty p= — a revoked key still in use
- SPF include points at a domain with no SPF record — a silent PermError
- DMARC record syntax errors that make receivers skip your policy
- DMARC external destination not authorized — why you receive no reports
- Two DMARC records at _dmarc — why your policy is being ignored